2 # The Girocco jail setup script
4 # We are designed to set up the chroot based on binaries from
5 # amd64 Debian lenny; some things may need slight modifications if
6 # being run on a different distribution.
12 # Verify we have all we neeed.
13 if ! getent group
$cfg_owning_group >/dev
/null
; then
14 echo "*** Error: You do not have $cfg_owning_group in system yet." >&2
19 mkdir
-p "$cfg_chroot"
21 chown root
"$cfg_chroot"
22 chmod 755 "$cfg_chroot"
24 # First, setup basic directory structure
25 mkdir
-p bin dev etc lib sbin srv
/git var
/run proc
30 # Set up basic user/group configuration; if there is any already,
31 # we hope it's the same numbers and users.
33 if [ ! -s etc
/passwd
]; then
35 sshd:x:101:65534:priviledge separation:/var/run/sshd:/bin/false
36 $cfg_cgi_user:x:$(getent passwd "$cfg_cgi_user" | cut -d : -f 3-5):/:/bin/true
37 $cfg_mirror_user:x:$(getent passwd "$cfg_mirror_user" | cut -d : -f 3-5):/:/bin/true
38 mob::65538:65534:the mob:/:/bin/git-shell
42 if [ ! -s etc
/group
]; then
44 _repo:x:$(getent group "$cfg_owning_group" | cut -d : -f 3):$cfg_mirror_user
49 rm -f dev
/null dev
/zero dev
/random dev
/urandom
52 mknod dev
/random c
1 8
53 mknod dev
/urandom c
1 9
54 chmod a
+rw dev
/null dev
/zero dev
/random dev
/urandom
58 chown
65538 var
/run
/mob
61 # Set up sshd configuration:
65 chown
$cfg_cgi_user:$cfg_owning_group etc
/sshkeys etc
/sshkeys
/mob
66 chmod g
+ws etc
/sshkeys
67 chmod g
+w etc
/sshkeys
/mob
70 if [ ! -s etc
/ssh
/sshd_config
]; then
71 cat >etc
/ssh
/sshd_config
<<EOT
77 UsePrivilegeSeparation yes
79 AuthorizedKeysFile /etc/sshkeys/%u
83 PermitEmptyPasswords yes
84 ChallengeResponseAuthentication no
85 PasswordAuthentication yes
88 if [ ! -s etc
/ssh
/ssh_host_dsa_key
]; then
89 yes | ssh-keygen
-N "" -C Girocco
-t dsa
-f etc
/ssh
/ssh_host_dsa_key
91 if [ ! -s etc
/ssh
/ssh_host_rsa_key
]; then
92 yes | ssh-keygen
-N "" -C Girocco
-t rsa
-f etc
/ssh
/ssh_host_rsa_key
95 # Bring in basic libraries:
98 cp -t lib
/lib
/ld-linux.so
.2
99 [ ! -d /lib64
] ||
cp -t lib
/lib64
/ld-linux-x86-64.so
.2
101 cp -t lib
/lib
/libc.so
.6 /lib
/libcrypt.so
.1 /lib
/libutil.so
.1 /lib
/libnsl.so
.1 /lib
/libnss_compat.so
.2 /lib
/libresolv.so
.2 /lib
/libdl.so
.2 /lib
/libgcc_s.so
.1
103 # Now, bring in sshd and sh.
108 # ...and all the dependencies.
109 ldd
"$bin" |
grep -v linux-gate |
grep -v linux-vdso |
grep -v ld-linux |
grep '=>' |
awk '{print $3}' |
xargs -r -- cp -u -t lib
112 pull_in_bin
/bin
/sh bin
113 pull_in_bin
/bin
/nc.openbsd bin
114 # If /sbin/sshd is already running within the chroot, we get Text file busy.
115 pull_in_bin
/usr
/sbin
/sshd sbin ||
:
117 # ...and the bits of git we need.
118 for i
in git git-index-pack git-receive-pack git-shell git-update-server-info git-upload-archive git-upload-pack git-unpack-objects
; do
119 if [ -e /usr
/lib
/git-core
/$i ]; then
120 pull_in_bin
/usr
/lib
/git-core
/$i bin
122 pull_in_bin
/usr
/bin
/$i bin
126 echo "--- Add to your boot scripts: mount --bind $cfg_reporoot $cfg_chroot/srv/git"
127 echo "--- Add to your boot scripts: mount --bind /proc $cfg_chroot/proc"
128 echo "--- Add to your syslog configuration: listening on socket $cfg_chroot/dev/log"